Re: Group member of another group

Using this through the GPO does just that. It will add your temporary group
to the local Administrators group of each workstation. Controlling it
through AD allows you to do this type of administration rather than
physically touching each workstation

Chris


"Hiro" <Hiro@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:97119E60-584C-4CF2-99BD-C45E7CF41EB4@xxxxxxxxxxxxxxxx
I read the article. But I wasn't able to apply it correctly to my
situation.

I already have the local admin group (Active Directory group) added to the
administrators group (local group) on Windows 2000/XP desktops that are
connected to the domain.

I need to create a secondary group called local admin temporary (AD
group).
This group needs to be a part of the local admin group (AD group). That
way I
don't have to go around to all the desktops and add the local admin
temporary
group (AD group) to the administrators group (local group).

Instead of revamping how we do the local admin setup with restricted
groups.
Is there a way to just make the local admin temporary group part of the
local
admin group?

"Chris Calderon" wrote:

As long as all your desktops are joined to the Active Directory domain,
you
manage this through group policies. Derek Melber wrote up an article on
using restricted groups.

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Check it out.

Chris

"Hiro" <Hiro@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8AFF59F7-ABF5-499E-A0CD-F5C2EA797B92@xxxxxxxxxxxxxxxx
I believe this is straight forward but I've never done it before. We
have a
AD group called Local Admins (Global security group). That group was
added
to
the Administrator group on all the desktops. Whenever we have a problem
we
add the user to that group until we can resolve the problem, we do
understand
the security risk with that.

We want to be able to add users to a new second group and make them
local
admins as well. How can I create a second group that is a member of the
original Local Admins group? That will I will not have to revisit the
all
the
desktops and add the new AD group the administrator local group.





.

Relevant Pages

  • RE: Automating Local Computer Admin Rights
    ... members of the administrators group on the local machine. ... become a local admin of all PC's under the OU. ... section it has "This group is a member of:" and there is nothing in there.. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Automating Local Computer Admin Rights
    ... ok ya go to restricted group but this is going to need to be a gpo attached ... members of the administrators group on the local machine. ... become a local admin of all PC's under the OU. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Automating Local Computer Admin Rights
    ... members of the administrators group on the local machine. ... become a local admin of all PC's under the OU. ... section it has "This group is a member of:" and there is nothing in there.. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Give Domain Users Local Admin Rights
    ... I know that I could add the indivdual domain user to the ... they do not have local admin ... >> I added DOMAIN USERS to the local administrators group ... >> are logged on to without giving them Local Admin rights ...
    (microsoft.public.windowsxp.security_admin)
Loading